diff --git a/node_modules/tar/lib/path-reservations.js b/node_modules/tar/lib/path-reservations.js
index 1929ac9c2099..167447af0805 100644
--- a/node_modules/tar/lib/path-reservations.js
+++ b/node_modules/tar/lib/path-reservations.js
@@ -8,6 +8,7 @@
 
 const assert = require('assert')
 const normPath = require('./normalize-windows-path.js')
+const { join } = require('path')
 
 module.exports = () => {
   // path => [function or Set]
@@ -19,9 +20,8 @@ module.exports = () => {
   const reservations = new Map()
 
   // return a set of parent dirs for a given path
-  const { join } = require('path')
   const getDirs = path =>
-    normPath(join(path)).split('/').slice(0, -1).reduce((set, path) =>
+    path.split('/').slice(0, -1).reduce((set, path) =>
       set.length ? set.concat(normPath(join(set[set.length - 1], path)))
       : [path], [])
 
@@ -99,6 +99,7 @@ module.exports = () => {
   }
 
   const reserve = (paths, fn) => {
+    paths = paths.map(p => normPath(join(p)).toLowerCase())
     const dirs = new Set(
       paths.map(path => getDirs(path)).reduce((a, b) => a.concat(b))
     )
diff --git a/node_modules/tar/lib/unpack.js b/node_modules/tar/lib/unpack.js
index 3295015952fa..cf10d07347b6 100644
--- a/node_modules/tar/lib/unpack.js
+++ b/node_modules/tar/lib/unpack.js
@@ -220,6 +220,8 @@ class Unpack extends Parser {
         const linkparts = normPath(entry.linkpath).split('/')
         if (linkparts.length >= this.strip)
           entry.linkpath = linkparts.slice(this.strip).join('/')
+        else
+          return false
       }
     }
 
diff --git a/node_modules/tar/package.json b/node_modules/tar/package.json
index c95b771b3bf7..42f55d0356ca 100644
--- a/node_modules/tar/package.json
+++ b/node_modules/tar/package.json
@@ -2,7 +2,7 @@
   "author": "Isaac Z. Schlueter <i@izs.me> (http://blog.izs.me/)",
   "name": "tar",
   "description": "tar for node",
-  "version": "6.1.7",
+  "version": "6.1.8",
   "repository": {
     "type": "git",
     "url": "https://github.com/npm/node-tar.git"
diff --git a/package-lock.json b/package-lock.json
index 4d27861d14a5..8e352377b1c1 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -11,6 +11,7 @@
         "@npmcli/arborist",
         "@npmcli/ci-detect",
         "@npmcli/config",
+        "@npmcli/map-workspaces",
         "@npmcli/package-json",
         "@npmcli/run-script",
         "abbrev",
@@ -143,7 +144,7 @@
         "rimraf": "^3.0.2",
         "semver": "^7.3.5",
         "ssri": "^8.0.1",
-        "tar": "^6.1.7",
+        "tar": "^6.1.8",
         "text-table": "~0.2.0",
         "tiny-relative-date": "^1.3.0",
         "treeverse": "^1.0.4",
@@ -9450,9 +9451,9 @@
       }
     },
     "node_modules/tar": {
-      "version": "6.1.7",
-      "resolved": "https://registry.npmjs.org/tar/-/tar-6.1.7.tgz",
-      "integrity": "sha512-PBoRkOJU0X3lejJ8GaRCsobjXTgFofRDSPdSUhRSdlwJfifRlQBwGXitDItdGFu0/h0XDMCkig0RN1iT7DBxhA==",
+      "version": "6.1.8",
+      "resolved": "https://registry.npmjs.org/tar/-/tar-6.1.8.tgz",
+      "integrity": "sha512-sb9b0cp855NbkMJcskdSYA7b11Q8JsX4qe4pyUAfHp+Y6jBjJeek2ZVlwEfWayshEIwlIzXx0Fain3QG9JPm2A==",
       "inBundle": true,
       "dependencies": {
         "chownr": "^2.0.0",
@@ -17385,9 +17386,9 @@
       }
     },
     "tar": {
-      "version": "6.1.7",
-      "resolved": "https://registry.npmjs.org/tar/-/tar-6.1.7.tgz",
-      "integrity": "sha512-PBoRkOJU0X3lejJ8GaRCsobjXTgFofRDSPdSUhRSdlwJfifRlQBwGXitDItdGFu0/h0XDMCkig0RN1iT7DBxhA==",
+      "version": "6.1.8",
+      "resolved": "https://registry.npmjs.org/tar/-/tar-6.1.8.tgz",
+      "integrity": "sha512-sb9b0cp855NbkMJcskdSYA7b11Q8JsX4qe4pyUAfHp+Y6jBjJeek2ZVlwEfWayshEIwlIzXx0Fain3QG9JPm2A==",
       "requires": {
         "chownr": "^2.0.0",
         "fs-minipass": "^2.0.0",
diff --git a/package.json b/package.json
index c64238146aa2..c426a5ff8a04 100644
--- a/package.json
+++ b/package.json
@@ -114,7 +114,7 @@
     "rimraf": "^3.0.2",
     "semver": "^7.3.5",
     "ssri": "^8.0.1",
-    "tar": "^6.1.7",
+    "tar": "^6.1.8",
     "text-table": "~0.2.0",
     "tiny-relative-date": "^1.3.0",
     "treeverse": "^1.0.4",